WordPress.org

Ready to get started?Download WordPress

Forums

CSF Firewall and WordPress Update (6 posts)

  1. Claymenia
    Member
    Posted 2 months ago #

    Hi,

    I've on my both VPS CSF installed, but i've this problem : impossible to update wordpress core or plugins... error "couldn't connect to host"

    I f i desactivated csf, not problem...

    Can you help me ?

  2. Dave Naylor
    Member
    Posted 2 months ago #

    Can you say what CSF is blocking on your server?

  3. Claymenia
    Member
    Posted 2 months ago #

    csf is blocking ? what do you mean ?

  4. Dave Naylor
    Member
    Posted 2 months ago #

    I've made the assumption that CSF is ConfigServer Security and Firewall (CSF)

    Blocking things is what firewalls do, so we need to know what it's blocked in this instance.

  5. Claymenia
    Member
    Posted 2 months ago #

    okay :

    He block this ip :

    211.160.19.250 # lfd: (pop3d) Failed POP3 login from 211.160.19.250 (CN/China/-): 10 in the last 3600 secs - Sat May  3 15:30:29 2014
    216.172.32.117 # lfd: (pop3d) Failed POP3 login from 216.172.32.117 (CA/Canada/-): 10 in the last 3600 secs - Sun May  4 15:50:45 2014
    79.105.149.168 # lfd: (ftpd) Failed FTP login from 79.105.149.168 (RU/Russian Federation/-): 10 in the last 3600 secs - Mon May  5 04:57:55 2014
    128.73.175.108 # lfd: (ftpd) Failed FTP login from 128.73.175.108 (RU/Russian Federation/128-73-175-108.broadband.corbina.ru): 10 in the last 3600 secs - Mon May  5 05:01:25 2014
    85.118.102.174 # lfd: (ftpd) Failed FTP login from 85.118.102.174 (GE/Georgia/-): 10 in the last 3600 secs - Mon May  5 05:09:01 2014
    185.24.233.224 # lfd: (pop3d) Failed POP3 login from 185.24.233.224 (IE/Ireland/224.233.24.185.srvbyt.com): 10 in the last 3600 secs - Tue May  6 16:57:02 2014
    94.23.4.225 # lfd: (ftpd) Failed FTP login from 94.23.4.225 (FR/France/ns365501.ovh.net): 10 in the last 3600 secs - Tue May  6 22:04:33 2014

    I've this in lfd :

    May  6 21:10:25 vps62122 lfd[1786]: *Suspicious Process* PID:1238 PPID:21486 User:******* Uptime:117 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/******/public_html/wp-admin/update-core.php
    May  6 21:38:26 vps62122 lfd[4950]: *Suspicious Process* PID:4901 PPID:4861 User:****** Uptime:65 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/******/public_html/wp-admin/update-core.php

    But not blocked, yhis is my config :

    SETTING		current
    AT_ALERT		2
    AUTO_UPDATES		1
    ICMP_IN_RATE		1/s
    LF_CPANEL		5
    LF_CPANEL_ALERT		1
    LF_DIRWATCH		300
    LF_EXIMSYNTAX		10
    LF_FTPD	                10
    LF_HTACCESS		5
    LF_IMAPD		10
    LF_INTEGRITY		3600
    LF_MODSEC		5
    LF_PERMBLOCK		1
    LF_POP3D		10
    LF_QUEUE_ALERT		2000
    LF_SCRIPT_ALERT		1
    LF_SMTPAUTH		5
    LF_SSHD		        5
    PACKET_FILTER		1
    PT_LIMIT		60
    RESTRICT_SYSLOG		3
    RESTRICT_UI		1
    RT_AUTHRELAY_ALERT	1
    RT_LOCALHOSTRELAY_ALERT	1
    RT_LOCALRELAY_ALERT	1
    RT_POPRELAY_ALERT	1
    RT_RELAY_ALERT		1
    SMTP_BLOCK		1
    ST_ENABLE		1
  6. Dave Naylor
    Member
    Posted 2 months ago #

    Well it seems clear that CSF is stopping the updates for some reason. I'm unfamiliar with configuring that tool, I use iptables directly.

    Maybe ask in the CSF forums (via the link I provided above).

Reply

You must log in to post.

About this Topic